CIA Triad Explained: Confidentiality, Integrity, Availability

What the CIA triad means

The CIA triad is an information-security model with three objectives: confidentiality protects against unauthorized disclosure, integrity protects against improper changes or destruction, and availability keeps information usable by authorized people and services when needed. It helps you describe what must be protected before choosing safeguards.

These are three views of the same information or service. An incident can affect one, two, or all three. NIST’s FIPS 199 uses these objectives to categorize potential impacts on federal information and systems. The model is also useful for everyday security decisions; it does not require every reader to adopt that federal categorization process.

Confidentiality: access should match permission

Confidentiality concerns who may access or receive information. It applies to a printed salary report, a shared spreadsheet, a database query, and a backup copy. Disclosure can result from an attack or a mistake: selecting the wrong email recipient is enough.

NIST’s confidentiality definition centers on preserving authorized restrictions on access and disclosure. “Keep everything secret” is too broad. Payroll staff need access to carry out their jobs; unrelated colleagues generally do not.

Restrict access to the necessary records and actions, check recipients and sharing settings, and protect stored and transmitted data where appropriate. Least privilege helps turn that need into specific permissions.

Encryption has a boundary. If a compromised application is allowed to decrypt a record and display it, storage encryption alone will not stop that disclosure. OWASP’s cryptographic-storage guidance explains why protection depends on where encryption happens and which threat it addresses.

Integrity: legitimate changes must remain distinguishable from tampering

Payroll records must change when someone joins, earns a different amount, or updates payment details. Integrity therefore means controlling and verifying changes, rather than freezing every record forever. NIST’s integrity definitions include protection against improper modification or destruction.

In the example, an attacker substitutes their account number while leaving the employee’s name and salary unchanged. The system may look normal and remain online, yet the next payment will be wrong. An accidental typo or faulty import can also damage integrity; an attacker is not required. Controls can include restricted editing, independent approval of sensitive changes, input checks, and protected change records.

A matching file hash answers a narrower question: do these bytes match the reference? It does not establish that the reference was trustworthy or that a payroll instruction was legitimate. The encryption, hashing, and encoding comparison explains that boundary.

For payment-detail changes, the existing business email compromise guide shows how independent verification protects the business decision beyond the file itself.

Availability: the task must work when it matters

A server responding to a health check is insufficient if authorized staff cannot sign in, retrieve the records, or finish payroll before its deadline. NIST defines availability around timely, reliable access and use.

Outages can follow a denial-of-service attack, equipment failure, a bad configuration change, or the loss of a necessary dependency. Design for the relevant causes: capacity and resilience, maintained systems, workable support procedures, and recoverable data serve different needs.

Backups support recovery; they do not keep every service running continuously. A usable recovery also needs the application, identities, configuration, and keys the task depends on. CIS Control 11 calls for restoring assets to a trusted state. The RPO and RTO guide explains how to set and test tolerable data loss and recovery time.

In payroll, define success as an authorized operator completing a verified run within the required period. That is a more useful check than simply finding that the backup job completed.

One incident can create three separate problems

Consider this hypothetical sequence: an attacker copies payroll records, changes payment details, then deletes the working data. Confidentiality is lost when the records are copied. Integrity is compromised by the unauthorized edits and destruction. Availability is affected when staff cannot use the records.

Restoring a verified copy from before the tampering may recover trustworthy records and help resume payroll. It does not recall stolen copies. It also cannot undo a fraudulent transfer already executed from the altered details. Those consequences need separate action.

Do not infer disclosure merely because a service went offline, or assume there was none because it came back. Record what the evidence supports for each objective. The incident response lifecycle connects investigation, containment, and recovery so that getting the service working does not prematurely end the response.

Balance the objectives against the actual consequence

The three objectives do not automatically have equal impact for every dataset. A published bus timetable needs accurate routes and timely access; its intended public contents do not need secrecy. Credentials and unpublished records in the publishing system still do.

FIPS 199 illustrates this distinction by assessing potential impact for each objective separately. Ask what happens to people and operations if the particular information is disclosed, changed, or unavailable. The everyday-risk guide adds likelihood and exposure to that consequence assessment.

Safeguards can create dependencies. Encrypting a payroll backup protects its contents, but losing the only decryption key can prevent recovery. OWASP’s guidance therefore includes key management as part of the design. Protect and test a controlled recovery route; leaving an unprotected spare key beside the backup would introduce a confidentiality weakness.

Describe the tradeoff and the intended outcome explicitly. “More security” is less useful than “authorized staff can recover payroll access during an outage without exposing the key to everyone.”

Use the triad to write a requirement you can check

Choose a real workflow and finish these three sentences. Be specific about the records, identities, permitted actions, and deadline:

• Confidentiality: only these people or services may read these records, including exported and backup copies.
• Integrity: these changes require this authority, validation, and evidence of approval.
• Availability: these authorized users must complete this task within this period, including during the disruption we are preparing for.

Then identify a safeguard, an owner, and a practical check for each requirement. For payroll, test that an unrelated account cannot read a record, an unapproved payment-detail change cannot take effect, and a controlled recovery enables a verified payroll run in time.

The CIA triad supplies the questions. Your workflow, consequences, and observed results determine whether the answers are adequate.